Tag Info

Hot answers tagged

11

Your friends might want to consider what the Chinese government might do if it finds them evading the firewall. Regimes that put up things like the Great Firewall aren't generally very understanding to people who evade their repression. Your friends have to balance the desire for private communications against the possibility of getting caught and the ...


10

You are basically asking if applying a signature and running a decryption are performed in the same way - the answer is no. You wrote: Digital encryption and signing is basically the mathematical multiplication of a mathematically-suitable representation of a message, by a very large number (the public/private keys). When the private key is ...


9

The scenario you describe requires multipe failures in the Web of Trust: The attacker would have to compromise the keyserver and put a fake copy of your public key there. Presumably if you're paranoid enough to use PGP you would have other people sign your key, so the attacker would have to get those people to sign the fake key (or contaminate an entire ...


8

There are several ways, which may or may not work: MonkeySphere openssh-gpg, a patch for OpenSSH SSH.com has built-in support gpg2 on Debian comes with a gpgkey2ssh tool, and gpg-agent can act as a ssh agent too, but I couldn't figure out how to actually make ssh use the key for authentication.


8

Encryption will never be "seamless" - particularly in a mixed environment. Similarly the idea that you'll be able to get outside agencies to adhere to your encryption policy is a noble goal, but may be difficult in practice (My company has been trying to get this to happen since before I came here. Some outside personnel are simply not going to be able to ...


7

You do not want a symmetric cipher If you need to auto-run encryption you don't want to use a symmetric cipher with a passphrase (this is what gpg -ac does). Storing the passphrase in a script or in cron is unacceptable and pointless (seriously, this sounds harsh, but you may as well rot13 it.) If you're using encryption, it isn't enough to simply "change ...


6

The problem is that you first have to import the keys in your keyring. After that it's quite easy to automate. I believe that this should work: gpg --no-default-keyring --keyring x.gpg --import x.pub gpg --no-default-keyring --keyring x.gpg --encrypt file1.txt gpg --no-default-keyring --keyring y.gpg --import y.pub gpg --no-default-keyring --keyring y.gpg ...


6

Public keys don't change just because someone removed (or changed) the passphrase on the private key. I see no reason why you would have to install this "new" public key. I'd be concerned as to the competence of the other party if they're complaining that they have to always enter their passphrase (and that they thought it was a winning idea to remove the ...


5

I think the most common way is to send a plain text email (as it may be read on iphone, android, etc - a device that does not have built in email decryption). OTOH, all devices understand HTTPS. So the plain text email says something like, "You have a secure message from your health care provider. Please click this link to login to view your message."


5

Generally speaking, you need to be validating keys before you trust them. In the case that you've outlined, that would mean only trusting the key if it's given to you through a secure channel (validated SSL, for instance), or in some other way that you trust (thumbprint hash communicated through a different means for validation, for instance).


5

Yes, it is possible. But the only good way that I can think of to do it using Active Directory is to modify the AD schema. Modifying the AD schema is one of those things that administrators shy away from doing because one, it is basically irreversible (by "irreversible" I mean without an authoritative restore) and two, making irreversible changes to a ...


4

You are required to encrypt the data end to end. You can use TLS to send the email to their systems. Note that you cannot send email to another firm without them also being hipaa and hitech compliant. Since their ePHI must already be stored in an encrypted format you do not have to worry about encrypting the data prior to transmission. That being said ...


4

Pick whatever MTA and list manager you want. Install procmail, write quick procmail recipe to look for PGP signatures - allow message if the sig is found, deny if not found.


4

To sign automatically all future git commits, you can define a global alias. For example, to create a global alias called "c", you would do this: $ git config --global alias.c 'commit -s' (note that the commit switch to sign off is lowercase "-s" and NOT uppercase "-S", as you typed in your question). After having done this, you can start doing your ...


3

PGP is not an in-transit encryption technology as SSL/TLS is. You'll most likely need to use PGP to encrypt the files, transfer them, and then decrypt on the other side. This process could be easily automated if that is desirable.


3

Man in the middle (MITM) attacks are probably the most viable means of defeating public key cryptosystems. You can thwart a MITM by verifying certificates with information from an independent second channel. Unfortunately, such verification is not always easy, or foolproof. In the case of systems having no central certifying authorities (like PGP/GnuPG), ...


3

Error in assumption; the opposite of encryption is decryption, and signing does not operate transitively on either. Signing a message has no effect whatsoever on the encryption.


3

I haven't done this exactly, but something similar. What I would do is: Install a fresh OS X on your new drive. Patch to the same level as your old drive. Install WDE and whatever else you need. Hook up your Time Machine disk, use the Migration Assistant (/Applications/Utilities/Migration Assistant) to import things from the disk. Start Time Machine again ...


3

I'm not sure you want a server that hosts everyone's private keys. This basically defeats the purpose, since if that server gets compromised then so do their keys, and then goes the data... The keyservers currently in existence allow people to look up people's public keys, but will not assign keys to anyone. The most notable of these keyservers is SKS. Yes, ...


3

You'll need to take a few steps here. First may well be user education. Explain to your users that email is like writing on a postcard, anyone along the way can see the message. You'll want to find a PGP (GPG) client that integrates with each mail client in use on your network. Start with the most widely used client. I'd guess that is Outlook so take a ...


3

+1 for womble; writing this as an answer to avoid chaaracter limit. The public key does not have to change when the secret key is decrypted. "Removing the passphrase" for the secret key just means it is left in a decrypted state permanently and written to disk, whereas generally the secret key is itself symmetrically encrypted with a given passphrase to ...


3

The classical approach is that every user should have his own key pair (private/public). The public keys should be available to all users (using a LDAP server for example), hence, when John send an email to Paul, he encrypts the mail with Paul's public key in order to ensure that only Paul will be able to read this mail. Note that this does not assure ...


3

Decompression happens after decryption, so it's theoretically possible to get GPG to write out the compressed data stream. I'm not sure there's a stock option to do that-- you'll probably have to hack around in the source. Once you've got the corrupt data stream, though, I'm not sure you're going to have much hope for getting the data back. I'm seeing that ...


2

Gmail S/MIME plugin for firefox.


2

FireGPG can use GnuPG, but I couldn't find any mention of S/MIME.


2

Assuming your eSATA drives can deliver close to standard SATA speeds and you are using 7200 RPM drives we're looking at sustaining around 80-100MB/sec across the whole drive under ideal conditions. I don't have any specifics about PGP but benchmarks of AES encryption speeds in the range of 100-150MByte / sec per core for 2008 era CPU's (3Ghz Core Duo) are ...


2

This is what ended up with: #!/bin/sh tmpfile=$(mktemp gpgverifyXXXXXX) trap "rm -f $tmpfile" EXIT gpg --status-fd 3 --verify "$@" 3> $tmpfile || exit 1 egrep -q '^\[GNUPG:] TRUST_(ULTIMATE|FULLY)' $tmpfile This looks for the trust information that gpg outputs on --status-fd. The script exits with an error in the presence of an untrusted signature ...


1

by using --import and make it default key



Only top voted, non community-wiki answers of a minimum length are eligible